Closed Bug 618118 Opened 9 years ago Closed 9 years ago

Crash when uninstalling an add-on with bad bootstrap.js [@ JSCompartment::wrap ]

Categories

(Core :: XPConnect, defect, critical)

defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla2.0b8
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: Mardak, Assigned: timeless)

Details

(Keywords: crash)

Crash Data

Attachments

(2 files)

Attached file throw 0 bootstrap.js
If I have a bootstrap.js that does just "throw 0;", uninstalling it then reloading about:addons results in a crash. Interestingly, if I install over the add-on, it doesn't crash (so this is somewhat the opposite of bug 618101).

I've attached an add-on that only has "throw 0;" in bootstrap.js.
Keywords: crash
Probably not directly an add-on manager bug, but could probably work around the issue there if necessary.

Might be useful in tracking down the other [@ JSCompartment::wrap ] crashes though? bug 605290 bug 613728 bug 615989

It seems like the uninstall needs to be user triggered. Having the add-on uninstall itself on startup/install doesn't cause the crash.
Assignee: nobody → general
Component: Add-ons Manager → JavaScript Engine
Product: Toolkit → Core
QA Contact: add-ons.manager → general
Version: unspecified → Trunk
Severity: normal → critical
This one is a gimme: need to check ok and not wrap the value if the script execution failed:

http://hg.mozilla.org/mozilla-central/annotate/11e328a49e0a/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp#l407
Assignee: general → nobody
blocking2.0: --- → beta9+
Component: JavaScript Engine → XPConnect
OS: Mac OS X → All
QA Contact: general → xpconnect
Hardware: x86 → All
Attached patch check okSplinter Review
Assignee: nobody → timeless
Status: NEW → ASSIGNED
Attachment #496776 - Flags: review?(jst)
Attachment #496776 - Flags: review?(jst) → review+
Keywords: checkin-needed
http://hg.mozilla.org/mozilla-central/rev/4a05b01c5814
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Keywords: checkin-needed
Resolution: --- → FIXED
Target Milestone: --- → mozilla2.0b8
As per today's meeting, beta 9 will be a time-based release. Marking these all betaN+. Please move it back to beta9+ if  you believe it MUST be in the next beta (ie: trunk is in an unshippable state without this)
blocking2.0: beta9+ → betaN+
Edward, I was never able to reproduce this crash. Can you please verify that it is fixed for you? Thanks.
Status: RESOLVED → VERIFIED
Crash Signature: [@ JSCompartment::wrap ]
You need to log in before you can comment on or make changes to this bug.